Who We Are

The Hidden Cause is the data controller responsible for the personal data described in this Privacy Policy.

Email: privacy@thehiddencause.com
Address: 126 Upwell Road, March, Cambridgeshire, PE15 0DE, United Kingdom

We are established in the United Kingdom and process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). Where we process the personal data of individuals in the EU or EEA, the EU GDPR also applies.

What Data We Collect

We collect personal data that is needed to provide our online educational programs, membership in an online community, one-to-one consulting, and related digital products, and to operate and protect our website. During our current pre-launch phase, we mainly collect email addresses from visitors who sign up to be notified at launch.

The types of personal data we collect include:
Email address and subscription preferences (for launch notifications, newsletters, and marketing where you have consented)
Records of which transcripts and other downloadable materials you open from a personalized link we send you by email, held against your subscriber record
Account and membership information (such as the details you provide to create and manage your account and community membership)
Order, billing, and payment-related information (such as purchase details and billing details needed to process transactions; payment card details are handled by payment processors)
Booking and program delivery information (such as information needed to schedule and deliver consulting, bookings, and programs)
Support and communications (such as the content of messages you send us and our responses)
Cookie consent preferences (your choices about cookies and similar technologies, recorded through our consent management system)
Device and connection information (such as IP address, browser type, and similar technical information needed for the website to function and to help protect it)

We collect personal data from the following sources:
Directly from you when you sign up, create an account, place an order, book a service, subscribe to emails, or contact us for support
Automatically when you use the website, through technical logs and similar records (including IP address and browser information)
From cookies and similar technologies, where required, based on your choices in our cookie consent settings for non-essential cookies

Providing personal data is optional in some cases, but certain data is required to create an account, complete purchases, schedule bookings, deliver programs, and respond to your requests. If you choose not to provide required information, we may not be able to provide the relevant service.

How We Use Your Data

We use your personal data for the purposes below. For each purpose, we rely on one legal basis: consent, contract, or legitimate interest.

To create and manage your account and membership, and provide access to our community and digital products (legal basis: contract)
To process orders and payments and provide purchased products and services (legal basis: contract)
To schedule and deliver one-to-one consulting, bookings, and educational programs (legal basis: contract)
To respond to support enquiries and communicate with you about your requests (legal basis: contract)
To send email newsletters and marketing communications where you have consented (legal basis: consent)
To record which transcripts and other downloadable materials you open from a personalized link in our emails, so that we know which material is valued and what to produce next (legal basis: legitimate interest)
To record and apply your cookie preferences (legal basis: consent)
To operate, secure, and improve the website, including protecting against fraud, abuse, and security threats, and producing aggregated statistics from technical information that does not rely on cookies or other technologies that require consent (legal basis: legitimate interest)

Who We Share Your Data With

We share personal data only as needed to provide our services and operate the website.

Payment processors
We share order and payment-related information with payment processors to process transactions and handle payments securely. These providers process personal data according to their own privacy policies.

Email service providers
We share email addresses and related subscription information with email service providers to send launch notifications, newsletters, and marketing emails where you have consented, and to manage unsubscribes. These providers process personal data according to their own privacy policies.

Consent management (processed internally)
We use our own consent management system (Trustwards) to record and manage your cookie preferences. This data is processed internally and not shared with third parties.

International Data Transfers

We are based in the United Kingdom. Some of the service providers we use for website hosting, payment processing, and email/SMTP delivery may process personal data outside the United Kingdom, including in the United States. As a result, your personal data may be transferred to, and processed in, countries whose data protection laws differ from those in the UK.

Where we transfer personal data outside the United Kingdom, we rely on an appropriate safeguard or transfer mechanism recognised under UK data protection law — for example a UK adequacy decision, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. For transfers from the EU/EEA, we rely on the EU Standard Contractual Clauses or another valid mechanism. You can contact us for more information about the safeguards in place.

How Long We Keep Your Data

Account and membership data: kept while your account is active and for a reasonable period afterward, then deleted or anonymised on request.
Order and payment records: retained for up to 7 years to meet tax and legal obligations.
Email newsletter and subscriber data: kept until you unsubscribe or withdraw consent.
Support enquiries: kept for up to 2 years after the matter is resolved.
Cookie consent records: retained as required for compliance.
We delete or anonymise personal data once it is no longer needed for these purposes.

Cookie consent records: 10 years (to demonstrate compliance and address potential claims within legal limitation periods).
Security logs and technical records: 12 months.
Tax and accounting records: 10 years (legal requirement).

Marketing email data: until consent is withdrawn or user unsubscribes.

Your Rights

Under the UK GDPR (and the EU GDPR where it applies), you have the following rights regarding your personal data. Depending on where you live, similar or additional rights may apply under the laws described later in this policy:

To access your personal data and receive a copy of it
To correct inaccurate or incomplete personal data
To delete your personal data
To restrict processing of your personal data
To receive your personal data in a portable format and have it transferred where technically feasible
To object to certain processing, including processing based on legitimate interests
To withdraw consent at any time where we rely on consent (this does not affect processing already carried out before you withdrew consent)
Not to be subject to automated decision-making or profiling that produces legal effects or similarly significantly affects you

California consumers may also have rights described in the California Privacy Rights section below, including the right to opt-out of the sale or sharing of personal information and the right to limit the use and disclosure of sensitive personal information.

How to exercise your rights
To submit a request, contact us at privacy@thehiddencause.com. We may need to verify your identity before completing certain requests.

Response times
We aim to respond within one month where GDPR or LGPD applies, within 45 days for CCPA/CPRA requests (with a possible extension of an additional 45 days with notice), and within 30 days where PIPEDA applies.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Children’s Privacy

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Data Security

We implement appropriate technical and organizational measures designed to protect personal data. However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we take reasonable precautions to reduce risk.

Data Breach Notification

We maintain procedures to detect, report, and investigate security incidents. If a personal data breach occurs that poses a high risk to your rights and freedoms, we will notify you without undue delay and provide information about the nature of the breach, likely consequences, and the measures taken or proposed to address it.

If you suspect a security issue involving your personal data, please contact us at privacy@thehiddencause.com.

How to Lodge a Complaint

We encourage you to contact us first so we can try to resolve your concern.

If you are located in the UK, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), our lead supervisory authority: https://ico.org.uk/.

If you are located in the EU/EEA or Switzerland, you have the right to lodge a complaint with the competent data protection authority in your jurisdiction.

If you are a California consumer, you may contact the California Privacy Protection Agency (CPPA): https://cppa.ca.gov/

If you are located in Brazil, you may contact the ANPD (Autoridade Nacional de Proteção de Dados): https://www.gov.br/anpd/

If you are located in Canada, you may contact the Office of the Privacy Commissioner of Canada (OPC): https://www.priv.gc.ca/

Updates to This Policy

We review and update this Privacy Policy periodically. The “Last updated” date at the top of this policy indicates when changes were last made. If we make significant changes, we will provide notice by email and/or by a notice on our website. Changes take effect from the date indicated at the top of this policy. Where processing is based on consent, we will request new consent when required.

Contact Us

Email: privacy@thehiddencause.com
Address: 126 Upwell Road, March, Cambridgeshire, PE15 0DE, United Kingdom
Data Controller: The Hidden Cause

California Privacy Rights (CCPA/CPRA)

This section applies to California consumers.

Notice at Collection
In the last 12 months, we have collected the following categories of personal information:
Identifiers (such as name and email address)
Personal information categories listed in California law (such as billing address and payment-related details needed to complete a transaction)
Commercial information (such as records of products or services purchased)
Internet or other electronic network activity information (such as IP address and browser information used to operate and protect the website)

Business and commercial purposes for collection
We collect personal information to operate our website, create and manage accounts and memberships, process orders and payments, schedule and deliver bookings and programs, send launch notifications and emails you request, respond to support enquiries, and help protect the website and our users from fraud and security threats.

Sale and sharing
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Your CCPA/CPRA rights
You have the right to know what personal information we collect, use, disclose, and sell or share
You have the right to delete personal information, subject to exceptions under applicable law
You have the right to correct inaccurate personal information
You have the right to opt-out of the sale or sharing of personal information by a business (“Do Not Sell or Share My Personal Information”)
You have the right to limit the use and disclosure of sensitive personal information
You have the right not to receive discriminatory treatment for exercising your rights

Do Not Sell or Share My Personal Information
Because we do not sell personal information and do not share personal information for cross-context behavioral advertising, we do not offer a separate opt-out mechanism for sale/sharing. We will honor Global Privacy Control (GPC) signals as valid opt-out requests where applicable.

Sensitive personal information
We do not use sensitive personal information to infer characteristics about you. If you submit a request to limit the use and disclosure of sensitive personal information, you can do so by contacting us using the details below.

How to submit a request
Email us at privacy@thehiddencause.com. Please describe your request with enough detail for us to understand and respond.

Verification
To protect your information, we will take steps to verify your identity before responding to certain requests. The verification steps will depend on the nature of the request and the sensitivity of the information involved.

Response timing
We respond to verifiable consumer requests within 45 days. If we need more time, we may take up to an additional 45 days and will notify you of the reason for the extension.

Brazilian Data Protection (LGPD)

This section applies to individuals in Brazil.

Legal bases
We process personal data under LGPD based on consent (for example, for marketing emails and cookie preferences), contract (for example, to provide programs, memberships, consulting, and to process orders and payments), and legitimate interest (for example, to operate, secure, and protect the website and prevent fraud).

Your rights
You may have the right to request confirmation that we process your personal data and access to it, correction of incomplete, inaccurate, or outdated data, anonymization, blocking, or deletion of unnecessary or excessive data, portability, information about sharing, and deletion of personal data processed with consent, as well as the right to withdraw consent.

You also have the right to petition the ANPD regarding the processing of your personal data.

Data Protection Officer contact
To exercise your rights or ask questions, contact privacy@thehiddencause.com.

Canadian Privacy Rights (PIPEDA)

This section applies to individuals in Canada.

Accountability
We are responsible for personal information under our control and we take steps to protect it and to ensure that service providers handling personal information on our behalf provide an appropriate level of protection.

Meaningful consent
We seek meaningful consent for the collection, use, and disclosure of personal information, except where otherwise permitted or required by law. Where consent is required for marketing emails and non-essential cookies, you can choose whether to provide it and you can withdraw it at any time.

Access and accuracy
You have the right to request access to your personal information and to challenge the accuracy and completeness of the information and have it amended as appropriate.

Withdrawing consent
You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. For email marketing, you can withdraw consent by unsubscribing or by contacting us.

Complaints
If you have concerns about our privacy practices, you can contact us first at privacy@thehiddencause.com. You also have the right to complain to the Office of the Privacy Commissioner of Canada (OPC).